The Safe Move When You Can't Fully Reproduce the Fault: Decision Tree

Why this matters

The customer describes a real event, you cannot make it happen on the bench or on site, and now you have to decide what to leave behind. This is not a diagnosis question, it is a disposition question, and it carries the most liability of any call you run. Leave a genuinely dangerous fault energized because you could not reproduce it, and the next occurrence is a fire, a shock, a flood, or a gas event. The safe move is not "swap a part and hope." It is to size the worst credible outcome first, then decide whether the system is allowed to keep running.

Start here: size the worst credible outcome before anything else

Do not start with likelihood. Start with consequence. Ask what this fault does if it recurs while no one is watching.

• Could it kill or injure - gas, fire, shock, a scald, a fall, carbon monoxide? Then the system does not keep running unattended until the hazard is cleared or contained, reproduced or not. Absence of proof is not proof of safety.
• Could it flood or cause major property damage - a supply line, a drain, a pool overflow? Contain it (shut a valve, add a limit, restrict operation) rather than leaving it fully live.
• Is the worst case only lost comfort or a nuisance trip? Then monitoring is a legitimate choice, and the tree below applies.

Lead with the safety action that matches the worst case. You can always relax later; you cannot un-ring an event you left live.

Branch 1: can you make it fail-safe instead of fail-dangerous

Even without reproducing the fault, you can often change what happens when it does recur.

• Verify the protective device that would catch this fault actually works: the breaker, the high-limit, the relief valve, the float switch, the flame sensor. A working safety turns a dangerous failure into a controlled shutdown.
• If that protection is missing, defeated, or untested, that is your finding for the day. Restore it before you argue about the root cause.

A fault you cannot reproduce is far less frightening when the safety net under it is confirmed good.

Branch 2: choose the disposition

With the worst case sized and the safety net checked, pick one and say it plainly.

• De-energize and red-tag when the worst credible outcome is severe and you cannot confirm the protection. Lock it out, label why, and schedule the follow-up. Losing the appliance for a few days beats the event.
• Limited or supervised operation when the hazard is moderate and can be bounded: run it only while someone is home, only at reduced load, only with a temporary limit in place.
• Monitor with instrumentation when the worst case is minor: leave a logger, a leak alarm, or a recording device to capture the next occurrence, and set a clear check-back.

Branch 3: document what you could not confirm

The record protects the customer and you, and it is doubly important when you did not reproduce the fault.

• Write what the customer reported, what you tested, and what you could not make happen.
• State the disposition and why: what you left running, what you shut down, what the customer agreed to.
• Give the customer the two or three tells that mean call back now, so a recurrence is captured instead of ignored.

When to pick which disposition

The recap

1. Size the worst credible outcome before you weigh how likely it is.
2. Confirm the protective device that would catch this fault actually works.
3. Pick a disposition that matches the hazard: red-tag, bounded operation, or monitor.
4. Document what you could not reproduce, what you left running, and the tells that mean call back now.

References

• OSHA lockout/tagout and hazardous-energy control principles (29 CFR 1910.147)
• NFPA 70 and NFPA 54 for electrical and fuel-gas safety baselines
• Trade-standard practice for red-tag versus warn versus proceed decisions
• See related: Intermittent Fault Cannot Reproduce on Site Leave vs Monitor; Is This Safe to Leave Running